How to set HOMENET Variable in Mcafee Nitro SIEM
Issue
The issue we had was when we try to set HOMENET Variable in Policy Editor. The HOMENET variable is almost used in every rule that is used in Mcafee Nitro SIEM. However, we have observed that even though we have defined out custom values of Internet Subnet still the rules were showing that HOMENET variable is using 0.0.0.0/0.
Solution:
GO TO "Asset Manager" in Mcafee Nitro Siem as shown in the post
Go TO "Network Discovery"
CLICK "Homenet"
and specify your subnet, we wanted to include our whole subnet so we have mentioned 10.0.0.0/8.
After updating the value here, we have considerably reduced the false positives and this issue was solved.
Issue
The issue we had was when we try to set HOMENET Variable in Policy Editor. The HOMENET variable is almost used in every rule that is used in Mcafee Nitro SIEM. However, we have observed that even though we have defined out custom values of Internet Subnet still the rules were showing that HOMENET variable is using 0.0.0.0/0.
Solution:
GO TO "Asset Manager" in Mcafee Nitro Siem as shown in the post
Go TO "Network Discovery"
CLICK "Homenet"
and specify your subnet, we wanted to include our whole subnet so we have mentioned 10.0.0.0/8.
After updating the value here, we have considerably reduced the false positives and this issue was solved.
0 comments:
Post a Comment